A company needs to ensure all Azure VMs have a specific tag 'Environment' applied. Which Azure Policy effect automatically adds the tag if missing?

1. A Deny
2. B Audit
3. ✓ C Modify (append/modify tag) (correct answer)
4. D DeployIfNotExists

Shortcut: Modify effect can add, replace, or remove resource tags and properties on existing and new resources. A Modify policy with 'add' operation ensures the Environment tag is applied if missing.